last executing test programs:

4.562556922s ago: executing program 2 (id=26):
pwritev(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)

4.562373707s ago: executing program 2 (id=28):
futimesat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000))

4.359750906s ago: executing program 2 (id=29):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

3.981927876s ago: executing program 2 (id=34):
mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

3.981737044s ago: executing program 0 (id=39):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/lightnvm/control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/lightnvm/control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/lightnvm/control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/lightnvm/control', 0x800, 0x0)

3.981580206s ago: executing program 1 (id=35):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs', 0x800, 0x0)

3.979964281s ago: executing program 0 (id=41):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwbinder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwbinder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwbinder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwbinder', 0x800, 0x0)

3.979253283s ago: executing program 1 (id=42):
pivot_root(&(0x7f0000000000), &(0x7f0000000000))

3.922053883s ago: executing program 1 (id=43):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full', 0x800, 0x0)

3.921997763s ago: executing program 0 (id=44):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock', 0x800, 0x0)

3.921963714s ago: executing program 0 (id=45):
faccessat(0xffffffffffffffff, &(0x7f0000000000), 0x0)

3.902372448s ago: executing program 2 (id=40):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyprintk', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyprintk', 0x800, 0x0)

3.875010941s ago: executing program 0 (id=46):
expanding glob: /sys/**/*

290.107155ms ago: executing program 1 (id=48):
flock(0xffffffffffffffff, 0x8)

171.675871ms ago: executing program 1 (id=50):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000080)={0x1, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0})

121.922936ms ago: executing program 1 (id=51):
r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1)
r1 = epoll_create(0x4)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x4})

2.422045ms ago: executing program 0 (id=47):
msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4)

0s ago: executing program 2 (id=49):
syz_mount_image$hfs(&(0x7f0000000180), &(0x7f0000000080)='./file1\x00', 0x84, &(0x7f0000000000)=ANY=[], 0x8b, 0x2d5, &(0x7f0000025dc0)="$eJzs3c9OE10Yx/HfmSlteeHFUTAmxoVBia4M4Ma4aWKI1+BGI9KaEBqIiImysXFtvAD3bLwAL8KVMXGNK1deALsxZ3pKz7QzbYHQAfl+ktrO9Px5zsy0c56RZgTgwnq0sr93/7d9GClUKOmhFNi3bqok6aquVd9s7qzvNBv1QQ2FUlXJw0hJTdNXZm2zkVXV1ktqOJFdKmnaX4fTEcdx/KvoIFCkqnsOs94MpIr7dIZ+4bOs0rM80bPcCqXWGOM5i8yBDvRWM0XHAQAolmmf3wN3np928/cgkBbcad8////8v+B4T+aODooOoWDe+T/JsmJj9++l5K1uvmc06cp3ssSj9mPnYmW1j6zUBNOks8r+ZDGJJZh8ud5s3FvbatYDfVAtYfy8cE5STXWXs2ZF29/0fMa6tLK/sD+sdK6pZAwTdgzL3fhrNa/IbFanx93aozDfzHfzzET6rPrh/K8UG3/Mbk89nujGv5jX3Narp/Y5apfKGeVluxtK19MbduAow7yMRG5LxaHSFwiidJzlzFpl9dRqj24pryfXzmxmreUhteZsrS9ere7RnF/ztJlP5omZ1x991Yo3/w/s1l5Q/yczu5GkpDsyBo6nlJSM/FWtG5klg6OPBUfU3cYf9UIPNPP63e7GarPZ2B73CxvD2Du9mC8i9a7pHARnJcLjvbDfsf4aRY3t0nh6L59401XdTrGTmf4yld2N1YpfuD3Szgmxt8HOx3qE3jsX8IZGOMZvJRSmu9Pzy7wX/xPzD7NfHqad/3n5ymKS9Nh/ogHz9HjYtM1rcSkjN+heqv/Pa8m46/P5GdBUZgbX0mg5V1L31l3ptrdyf68yKOeKdEWH2fD5Z1b0Q8+5/g8AAAAAAAAAAAAAAAAAAHDejOPXGl53/B05AAAAAAAAAAAAAAAAAAAAAADHkH//36pO8f6/qd8BjHz/394bewI4kb8BAAD//+jIZ98=")
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x103042, 0x2)
lchown(&(0x7f0000000180)='./file1\x00', 0x0, 0xffffffffffffffff)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:8466' (ED25519) to the list of known hosts.
syzkaller login: [   55.698166][ T5790] cgroup: Unknown subsys name 'net'
[   55.819206][ T5790] cgroup: Unknown subsys name 'cpuset'
[   55.825800][ T5790] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.083606][ T5790] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   61.119461][ T5849] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   63.031218][ T5900] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.034459][ T5900] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.037276][ T5900] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.040895][ T5900] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.043366][ T5900] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.051287][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.055066][ T5900] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.061725][ T5902] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.064769][ T5900] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.065977][ T5902] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.073189][ T5902] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.073250][ T5906] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.081087][ T5902] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.083622][ T5902] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.087329][ T5902] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.437762][ T5897] chnl_net:caif_netlink_parms(): no params data found
[   63.496304][ T5903] chnl_net:caif_netlink_parms(): no params data found
[   63.515697][ T5899] chnl_net:caif_netlink_parms(): no params data found
[   63.555987][ T5897] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.558602][ T5897] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.560820][ T5897] bridge_slave_0: entered allmulticast mode
[   63.564183][ T5897] bridge_slave_0: entered promiscuous mode
[   63.572702][ T5897] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.575434][ T5897] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.577965][ T5897] bridge_slave_1: entered allmulticast mode
[   63.580934][ T5897] bridge_slave_1: entered promiscuous mode
[   63.632946][ T5903] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.635762][ T5903] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.638569][ T5903] bridge_slave_0: entered allmulticast mode
[   63.642160][ T5903] bridge_slave_0: entered promiscuous mode
[   63.645372][ T5903] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.647522][ T5903] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.649899][ T5903] bridge_slave_1: entered allmulticast mode
[   63.653730][ T5903] bridge_slave_1: entered promiscuous mode
[   63.658556][ T5897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.678853][ T5897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.706062][ T5903] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.715723][ T5899] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.718223][ T5899] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.720906][ T5899] bridge_slave_0: entered allmulticast mode
[   63.724054][ T5899] bridge_slave_0: entered promiscuous mode
[   63.729492][ T5903] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.742343][ T5899] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.744638][ T5899] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.747866][ T5899] bridge_slave_1: entered allmulticast mode
[   63.750654][ T5899] bridge_slave_1: entered promiscuous mode
[   63.767357][ T5897] team0: Port device team_slave_0 added
[   63.778394][ T5899] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.787925][ T5897] team0: Port device team_slave_1 added
[   63.790843][ T5903] team0: Port device team_slave_0 added
[   63.793817][ T5899] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.813254][ T5903] team0: Port device team_slave_1 added
[   63.837474][ T5899] team0: Port device team_slave_0 added
[   63.845776][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.848052][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.856609][ T5897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.862739][ T5899] team0: Port device team_slave_1 added
[   63.872261][ T5903] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.874565][ T5903] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.884086][ T5903] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.889388][ T5897] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.891550][ T5897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.900476][ T5897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.912574][ T5903] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.915373][ T5903] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.924460][ T5903] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.933018][ T5899] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.935712][ T5899] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.944204][ T5899] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.960313][ T5899] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.962433][ T5899] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   63.971451][ T5899] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.987228][ T5897] hsr_slave_0: entered promiscuous mode
[   63.989369][ T5897] hsr_slave_1: entered promiscuous mode
[   64.023369][ T5899] hsr_slave_0: entered promiscuous mode
[   64.025870][ T5899] hsr_slave_1: entered promiscuous mode
[   64.028409][ T5899] debugfs: 'hsr0' already exists in 'hsr'
[   64.030723][ T5899] Cannot create hsr debugfs directory
[   64.037716][ T5903] hsr_slave_0: entered promiscuous mode
[   64.039867][ T5903] hsr_slave_1: entered promiscuous mode
[   64.041900][ T5903] debugfs: 'hsr0' already exists in 'hsr'
[   64.043705][ T5903] Cannot create hsr debugfs directory
[   64.286136][ T5897] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.294248][ T5897] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.300381][ T5897] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.307228][ T5897] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.358342][ T5899] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   64.368509][ T5899] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   64.375489][ T5899] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   64.380487][ T5899] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   64.440591][ T5903] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.448771][ T5903] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.457026][ T5903] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   64.469139][ T5903] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   64.506268][ T5897] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.534767][ T5897] 8021q: adding VLAN 0 to HW filter on device team0
[   64.549989][ T4649] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.552931][ T4649] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.570898][ T4649] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.573771][ T4649] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.631370][ T5897] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   64.661263][ T5899] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.670409][ T5903] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.694246][ T5899] 8021q: adding VLAN 0 to HW filter on device team0
[   64.704214][ T5903] 8021q: adding VLAN 0 to HW filter on device team0
[   64.712539][ T1094] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.715452][ T1094] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.729482][ T1094] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.731574][ T1094] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.737558][ T1094] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.740410][ T1094] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.768459][ T1094] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.771378][ T1094] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.818994][ T5897] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.890139][ T5897] veth0_vlan: entered promiscuous mode
[   64.904270][ T5897] veth1_vlan: entered promiscuous mode
[   64.931602][ T5903] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.939308][ T5897] veth0_macvtap: entered promiscuous mode
[   64.948323][ T5897] veth1_macvtap: entered promiscuous mode
[   64.965165][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.977720][ T5897] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.990350][ T5899] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.992783][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.998035][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.000716][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.003228][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.014082][ T5903] veth0_vlan: entered promiscuous mode
[   65.042747][ T5903] veth1_vlan: entered promiscuous mode
[   65.097060][ T5899] veth0_vlan: entered promiscuous mode
[   65.105885][   T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.111069][   T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.115791][   T55] Bluetooth: hci2: command tx timeout
[   65.118066][   T55] Bluetooth: hci1: command tx timeout
[   65.119826][   T55] Bluetooth: hci0: command tx timeout
[   65.130962][ T5903] veth0_macvtap: entered promiscuous mode
[   65.143685][ T5899] veth1_vlan: entered promiscuous mode
[   65.151587][ T5903] veth1_macvtap: entered promiscuous mode
[   65.157862][   T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.162784][   T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.182277][ T5903] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.193968][ T5899] veth0_macvtap: entered promiscuous mode
[   65.205984][ T5903] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.209903][ T5899] veth1_macvtap: entered promiscuous mode
[   65.239792][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.246494][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.264322][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.268801][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.280621][ T5899] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.288269][ T5899] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.313856][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.319476][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.332923][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.342283][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.382515][ T4649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.389888][ T4649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.419708][ T4649] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.428557][ T4649] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.438465][ T4649] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.442631][ T4649] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.463343][ T4545] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.475937][ T4545] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.528405][ T5968] loop2: detected capacity change from 0 to 64
[   65.583757][ T4545] ------------[ cut here ]------------
[   65.585964][ T4545] kernel BUG at fs/hfs/inode.c:474!
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   65.596725][ T4545] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
[   65.598959][ T4545] CPU: 1 UID: 0 PID: 4545 Comm: kworker/u10:5 Not tainted syzkaller #0 PREEMPT(full) 
[   65.601896][ T4545] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   65.605196][ T4545] Workqueue: writeback wb_workfn (flush-7:2)
[   65.607168][ T4545] RIP: 0010:hfs_write_inode+0x934/0x960
[   65.609149][ T4545] Code: 40 31 ff e8 de 55 15 ff 81 e3 00 00 00 40 75 1c e8 91 51 15 ff 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 dc f7 ff ff e8 7d 51 15 ff 90 <0f> 0b e8 75 51 15 ff e8 20 b2 82 fe eb dd 44 89 f1 80 e1 07 80 c1
[   65.614816][ T4545] RSP: 0018:ffffc900077ff1a0 EFLAGS: 00010293
[   65.617144][ T4545] RAX: ffffffff82b04f83 RBX: ffff8881bae1bc18 RCX: ffff8881703c8000
[   65.620123][ T4545] RDX: 0000000000000000 RSI: ffffffff8e9c6980 RDI: 0000000000000000
[   65.623145][ T4545] RBP: ffffc900077ff328 R08: ffff8881703c8000 R09: 0000000000000003
[   65.625990][ T4545] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
[   65.628702][ T4545] R13: 1ffff92000effe38 R14: 0000000000000000 R15: ffff8881bae1bbd8
[   65.631674][ T4545] FS:  0000000000000000(0000) GS:ffff8882a945d000(0000) knlGS:0000000000000000
[   65.635046][ T4545] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   65.637707][ T4545] CR2: 00007f81f0f2b9c0 CR3: 00000001baa08000 CR4: 00000000000006f0
[   65.640838][ T4545] Call Trace:
[   65.642107][ T4545]  <TASK>
[   65.643219][ T4545]  ? __lock_acquire+0x6b5/0x2cf0
[   65.645011][ T4545]  ? __pfx_hfs_write_inode+0x10/0x10
[   65.646959][ T4545]  ? __pfx_hfs_writepages+0x10/0x10
[   65.648932][ T4545]  ? do_raw_spin_unlock+0x4d/0x210
[   65.651004][ T4545]  __writeback_single_inode+0x75a/0x11a0
[   65.653164][ T4545]  writeback_sb_inodes+0x992/0x1a20
[   65.655138][ T4545]  ? __pfx_writeback_sb_inodes+0x10/0x10
[   65.657346][ T4545]  ? do_raw_spin_lock+0x12b/0x2f0
[   65.659220][ T4545]  ? rcu_is_watching+0x15/0xb0
[   65.660986][ T4545]  wb_writeback+0x456/0xb70
[   65.662689][ T4545]  ? queue_io+0x251/0x4a0
[   65.664339][ T4545]  ? __pfx_wb_writeback+0x10/0x10
[   65.666221][ T4545]  ? do_raw_spin_lock+0x12b/0x2f0
[   65.668048][ T4545]  wb_workfn+0x414/0xf50
[   65.669676][ T4545]  ? look_up_lock_class+0x57/0x110
[   65.671591][ T4545]  ? __pfx_wb_workfn+0x10/0x10
[   65.673418][ T4545]  ? do_raw_spin_lock+0x12b/0x2f0
[   65.675408][ T4545]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   65.677518][ T4545]  ? process_scheduled_works+0xa8d/0x18c0
[   65.679752][ T4545]  ? process_scheduled_works+0xa8d/0x18c0
[   65.681860][ T4545]  process_scheduled_works+0xb6e/0x18c0
[   65.683954][ T4545]  ? __pfx_process_scheduled_works+0x10/0x10
[   65.686125][ T4545]  ? assign_work+0x3d5/0x5e0
[   65.687515][ T4545]  worker_thread+0xa53/0xfc0
[   65.689090][ T4545]  kthread+0x388/0x470
[   65.690387][ T4545]  ? __pfx_worker_thread+0x10/0x10
[   65.691913][ T4545]  ? __pfx_kthread+0x10/0x10
[   65.693509][ T4545]  ret_from_fork+0x51e/0xb90
[   65.695164][ T4545]  ? __pfx_ret_from_fork+0x10/0x10
[   65.696642][ T4545]  ? __switch_to+0xc7d/0x1450
[   65.698026][ T4545]  ? __pfx_kthread+0x10/0x10
[   65.699413][ T4545]  ret_from_fork_asm+0x1a/0x30
[   65.700909][ T4545]  </TASK>
[   65.701863][ T4545] Modules linked in:
[   65.704184][ T4545] ---[ end trace 0000000000000000 ]---
[   65.705204][ T5972] Invalid/unusable pipe
[   65.751027][ T5965] syz.1.51 (5965): drop_caches: 2
[   65.752687][ T4545] RIP: 0010:hfs_write_inode+0x934/0x960
[   65.754732][ T4545] Code: 40 31 ff e8 de 55 15 ff 81 e3 00 00 00 40 75 1c e8 91 51 15 ff 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 dc f7 ff ff e8 7d 51 15 ff 90 <0f> 0b e8 75 51 15 ff e8 20 b2 82 fe eb dd 44 89 f1 80 e1 07 80 c1
[   65.767166][ T4545] RSP: 0018:ffffc900077ff1a0 EFLAGS: 00010293
[   65.768918][ T4545] RAX: ffffffff82b04f83 RBX: ffff8881bae1bc18 RCX: ffff8881703c8000
[   65.771124][ T4545] RDX: 0000000000000000 RSI: ffffffff8e9c6980 RDI: 0000000000000000
[   65.773523][ T4545] RBP: ffffc900077ff328 R08: ffff8881703c8000 R09: 0000000000000003
[   65.779881][ T4545] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
[   65.782257][ T4545] R13: 1ffff92000effe38 R14: 0000000000000000 R15: ffff8881bae1bbd8
[   65.784751][ T4545] FS:  0000000000000000(0000) GS:ffff8882a945d000(0000) knlGS:0000000000000000
[   65.824868][ T4545] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   65.826883][ T4545] CR2: 000055fee7ee0068 CR3: 000000016a5e4000 CR4: 00000000000006f0
[   65.829332][ T4545] Kernel panic - not syncing: Fatal exception
[   65.831888][ T4545] Kernel Offset: disabled
[   65.833377][ T4545] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:36:08  Registers:
info registers vcpu 0

CPU#0
RAX=0000000080080783 RBX=1ffff1102d55ca62 RCX=00000000ffffffff RDX=0000000000010000
RSI=0000000000000000 RDI=0000000000000000 RBP=0000000000000000 RSP=ffffc90000007e68
R8 =ffff88816aae56ff R9 =1ffff1102d55cadf R10=dffffc0000000000 R11=ffffed102d55cae0
R12=dffffc0000000000 R13=ffff88816aae5310 R14=ffff88816aae4000 R15=ffff88816aae56f8
RIP=ffffffff869e4530 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fb47bf1d800 ffffffff 00c00000
GS =0000 ffff88818de5d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f4381401000 CR3=0000000113600000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000561e5d1f1a90 RBX=0000561e5d1f3aa0 RCX=0000000000000400 RDX=00007ffcdeb45538
RSI=0000561e5d20b8db RDI=0000561e5d1f3aa0 RBP=0000561e5d1e5950 RSP=00007ffcdeb45048
R8 =0000000000000001 R9 =0000000000000006 R10=fffffffffffff696 R11=0000000000000000
R12=0000561e5d1f8c60 R13=00007ffcdeb45538 R14=0000000000000000 R15=0000561e2067da04
RIP=0000561e2065c08b RFL=00000206 [-----P-] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA]
SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fd02aea7c80 ffffffff 00c00000
GS =0000 0000000000000000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f81f1d4da08 CR3=00000001bac81000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ff00000000000000 0000000000000000 XMM01=00ffffffffffffff ffffffffffffffff
XMM02=00434e455f4c4542 414c5f53465f4449 XMM03=0000000000000000 000000006d657473
XMM04=00000000000002b1 0000000000000020 XMM05=000000322a37622a 00006c7469746e75
XMM06=ffffff0000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffff0000000000 ffff000000000000 XMM09=000000323a37622f 64656c7469746e75
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
